154 matches found
CVE-2024-23738
CVE-2024-23738 macOS의 Postman 10.22 이하 버전에서 발생하는 문제로, 원격 공격자가 RunAsNode 및 enableNodeClilnspectArguments 설정을 통해 임의 코드를 실행할 수 있습니다. electron에서 취약점을 검색하는 프로세스를 자동화하도록 설계된 도구가 있습니다: https://github.com/r3ggi/electroniz3r 이 도구를 사용하면 앱이 취약한지 확인할 수 있습니다: 검증 후에는 코드를 주입하여 셸을 얻을 수 있습니다 셸을 즐기세요 :...
vapi
vAPI vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises. Requirements PHP MySQL PostMan MITM Proxy Installation Docker docker-compose up -d Installation Manual Copying the Code cd git clone...
porch-pirate
Porch Pirate Porch Pirate는 Postman 비밀을 신속하게 발견하기 위한 도구로 시작되었으며, 점차 Postman을 위한 다목적 정찰/OSINT 프레임워크로 진화하고 있습니다. 기존 도구들은 훌륭한 개념 증명이지만, 매우 특정한 키워드만 "비밀"로 식별하려고 시도하고, 매우 제한된 위치에서만 수행하며, 비밀 이상의 정찰은 고려하지 않습니다. 우리는 "비밀-무관"하고 거짓 양성을 포착할 수 있을 만큼 유연하며 여전히 공격적 가치를 제공하는 능력이 필요하다는 것을 깨달았습니다. Porch Pirate는 공개적으...
Burp_Collector
Burp Collector Burp Collector는 웹/모바일 애플리케이션 테스트에서 Pentester와 Bug Hunter를 지원하기 위해 특별히 설계된 멀티 프로세싱 도구입니다. 강력한 기능을 통해 Burp Suite 파일에서 정보를 수집하고 추출하는 과정을 간소화하여 API 엔드포인트를 효과적으로 관리할 수 있습니다. Burp Collector는 API 엔드포인트를 효율적으로 정리하고 Excel 시트로 원활하게 내보내 프로젝트의 구조적이고 접근하기 쉬운 개요를 제공합니다. 엔드포인트 관리를 간소화하여 귀중한 시간을...
docker-cve-2021-41773
CVE-2021-41773 Dockerコンテナ上でCVE-2021-41773の脆弱性を示すデモンストレーションです。 使用方法 サーバー build.shを実行する（docker buildを実行） ./scripts/build.sh 注：複数回実行する必要はありません deploy.shを実行する（build.shで作成したイメージからDockerコンテナを作成） ./scripts/deploy.sh コンテナを閉じるには、次のコマンドを実行します： docker rm --force cve-2021-41773 エクスプロイトの実演 bashを使用する場合：...
MAL-2026-14357 Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
BBOT: Arbitrary File Write in postman_download Module
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
PYSEC-2026-2393 BBOT: Arbitrary File Write in postman_download Module
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
PT-2026-59070
The postman download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacke...
MAL-2026-6639 Malicious code in @postman-app-monolith/renderer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4ea9912817d4d94e8b97e2b588237f3f2cddc29058e81d8958ec78b4b90d961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2026-37818
BBOT: Arbitrary File Write in postmandownload Module...
GHSA-M54H-VHF9-3W3M BBOT: Arbitrary File Write in postman_download Module
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
Out-of-bounds Read
Overview bbot is an OSINT automation for hackers. Affected versions of this package are vulnerable to Out-of-bounds Read via the postmandownload process. An attacker can write arbitrary files to the user's system by supplying a crafted workspace name containing path traversal characters...
BBOT: Arbitrary File Write in postman_download Module
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
CVE-2026-12568
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
CVE-2026-12568
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
CVE-2026-12568 Arbitrary File Write in postman_download module
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
CVE-2026-12568 Arbitrary File Write in postman_download module
The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...
CVE-2026-12568
The CVE-2026-12568 entry affects the postman_download module. The root cause is unsanitized use of the workspace name field from the Postman API to build the local output directory path; if the workspace name contains path traversal characters, pathlib resolves outside the intended directory, ena...